The present invention relates to a constant period signal monitoring circuit for monitoring a predetermined constant period signal that is output periodically when a control processor operating according to a predetermined program is normal from the outside of the control processor.
A control micro-processor, i.e., a microcomputer (CPU: central processing unit), operating according to a predetermined program is incorporated in various electric control units (ECUs) to be mounted on vehicles.
Such a microcomputer usually carries out various controls as intended according to the content of a program prepared beforehand. However, for example, in the case that the microcomputer is affected due to electromagnetic noise entering from the outside, in the case that the microcomputer becomes faulty, or in the case that the microcomputer is affected due to defects (bugs) contained in the program itself, the microcomputer may sometimes cause an unexpected operation and may be brought into a runaway state.
If the microcomputer is brought into such a runaway state, the entire electric control unit falls into an uncontrollable state. Hence, in the systems of such various electric control units, it is necessary to monitor whether abnormality has occurred in the microcomputer, and in the case that the occurrence of abnormality is detected, it is necessary to return the microcomputer to its normal state.
Hence, in such various electric control units, the microcomputer performs control so as to periodically output pulses referred to as a watchdog signal to the outside. Furthermore, a monitoring circuit is connected to the outside of the microcomputer, and this monitoring circuit always monitors the watchdog signal output from the microcomputer. If abnormality occurs in the microcomputer, the watchdog signal does not appear. Upon detecting the state in which the watchdog signal does not appear for a constant time, the monitoring circuit initializes the operation of the microcomputer.
In the on-vehicle electronic control unit according to JP-A-2010-13988, if the main CPU 10 shown in FIG. 1 is brought into a runaway state and the pulse width of a watchdog signal WDS becomes excessively large, a power control circuit 113 detects this state and generates a reset pulse signal RST.
Also in the vehicle-use electronic control system according to JP-A-2011-98593, the watchdog timer 24 incorporated in a power source control IC 23 monitors the operation state of a CPU 1 on the basis of the watchdog signal transmitted from the CPU 1 and transmits a reset signal RST when abnormality occurs.
As described in JP-A-2010-13988 and JP-A-2011-98593, abnormality in the operation of the microcomputer can be detected by monitoring the watchdog signal output from the microcomputer. In addition, upon detecting abnormality, the circuit for monitoring the watchdog signal applies the reset signal to the microcomputer. When the reset signal is applied, the microcomputer initializes the state of the hardware and restarts the execution of the program from the head position thereof as at the time of power supply.
Hence, in the case that the microcomputer is brought into a runaway state due to a temporary factor, such as the entry of electromagnetic noise, the operation of the microcomputer can be returned to its normal state by applying the reset signal.
However, in the case that a continuous failure occurs inside the microcomputer, the operation of the microcomputer cannot be returned to its normal state even if the reset signal is applied. Furthermore, in the case that a failure occurs in the microcomputer provided in an electronic control unit for on/off controlling the energization of a load, the energization of the load cannot be turned on/off even in the case that a circuit for monitoring the watchdog signal is mounted.
Hence, it is desirable that a backup circuit should be mounted on an on-vehicle electronic control unit or the like in preparation for the occurrence of a failure in the microcomputer. In other words, instead of the microcomputer, a circuit for generating a backup control signal for controlling a load is necessary so that the energization of the load can be turned on/off even in the case that the microcomputer is faulty.
However, in the case that the program of the microcomputer is brought into a runaway state, the state of the output port of the microcomputer from which the watchdog signal is output becomes uncertain. That is to say, there occurs a case in which a low level (a potential close to 0 V) is output or a case in which a high level (a potential close to 5 V) is output from the output port.
Hence, in the circuit for monitoring the watchdog signal, it is necessary to ignore the DC potential of the signal and to monitor only the change in potential (AC components). In an electric circuit for this kind of use, it is a general practice that a capacitor is connected to the input of the monitoring circuit to shut off DC components.
A configuration example of the monitoring circuit in which a capacitor is connected to the input is shown in FIG. 4. In addition, examples of signal waveforms at various sections in the monitoring circuit are shown in FIG. 5.
In the monitoring circuit shown in FIG. 4, the watchdog signal w/D output periodically from the microcomputer is applied to an input terminal 54. This watchdog signal is input to the clear terminal CLR of a counter 51 via a capacitor C1 for shutting off DC components. Furthermore, the clear terminal of the counter 51 is grounded via a resistor R1. Moreover, the clock pulse signal CLK output from a clock generator 53 is applied to the clock input terminal CK of the counter 51.
When the level of the output signal of the counter 51 becomes “Hi”, the D-type flip-flop 52 connected to the output terminal Q3 of the counter 51 latches this state and generates a backup control signal SGbk.
As shown in FIG. 5, when the potential of a clear signal SGcr is lower than a clear threshold value, the counter 51 shown in FIG. 4 counts the number of the dock pulses CLK. Furthermore, when the potential of the clear signal SGcr is higher than the clear threshold value, the counter 51 clears the count value.
Since a time constant circuit including the capacitor C1 is used in the monitoring circuit in FIG. 4, the potential of the clear signal SGcr changes depending on the time constant of the circuit. Hence, as shown in FIG. 5, the time (clear time) during which the counter 51 maintains its clear state becomes relatively long. Furthermore, the backup recovery time from the stop of the watchdog signal W/D to the output of the backup control signal SGbk becomes long due to the influence of the clear time as shown in FIG. 5. In other words, in an electronic control unit for controlling the energization of a load, in the case that the microcomputer thereof becomes faulty, the backup control signal SGbk cannot be output quickly, whereby the time during which the load cannot be controlled becomes long. In addition, in a situation in which variation in the characteristic of the capacitor C1 due to individual differences is large, large variation may occur in the length of the backup recovery time.